Here we go again, ‘there shall be a weeping and gnashing of teeth' heard globally as pension funds, charities and banks lament the loss of billions of pounds because Madoff was a crook.

Sorry ‘alleged' crook.

While the Securities and Exchange Commission will certainly be puckering up because no matter how fast its excuses are spewed out of the press office, it fundamentally failed in its role. But it wasn't the only one.

Questions must be asked of investment managers, CEOs, auditors, compliance officers, those responsible for corporate governance, risk analysts, the list could continue.

It shows yet again that only lip service has been paid to corporate governance in the investing companies and risk management across the spectrum of what that entails.

Indeed it should come as no surprise that in this humble editor's opinion, many directors may face litigation under the Companies Act [1] for failing to use reasonable skills to defend the interest of their shareholders.

How it developed

We'll come back to the whingeing classes in a minute but let's look at what went wrong and how it could have been prevented. Firstly, Mr Made-off has only been hoisted by his own petard, according to the FBI, because he admitted to senior employees that he had been running a Ponzi scheme*. He had grabbed about $50 billion by paying returns to investors from money paid in by new investors, rather than his supposedly high profits from his securities' picking.

Now this pyramid scheme was all the more likely to collapse as investors began clamouring for their money back since the credit crunch. As individuals sought to shore up their mortgage payments, or banks decided to reduce their risk profile or maintain their capital adequacy requirements, hedge funds began to haemorrhage money. The Bank of England warned this development could have catastrophic effects.

Now Madoff was watching the keystone of his pyramid scheme gradually be pulled out.

Credit crunch only a catalyst, not cause

However even without the credit crunch 'last straw', investors and regulators should have long been worried about how Madoff had structured his company and his consistently higher returns.

According to a spokesman from PaamCo, a $9bn fund of hedge funds firm that serves institutional clients, neither it nor others like Blackstone, Meisrow, Quellos, Ivy or Grosvenor got caught out. Madoff could not survive a genuine due diligence process. But then fund of hedge funds also understand the murky investment methodologies and are unlikely to be as bamboozeled as long-only investment managers.

None-the-less, other signs should have slapped their faces.

Whingeing classes responsible

Now back to the whingeing classes. Firstly, it's interesting that it is mainly European institutions that have been caught out. In the UK, we've already heard Nicola Horlick whiplash the regulators, feted by broadcast outlets reminding us all that she's the ‘Superwoman of the City', the one that brought the male-dominated City to heel.

She fitted the media mould and her criticism of SEC regulators from this City ‘maverick' suited what the public now expect to hear. While I have no wish to only point fingers at Ms Horlick and I would never accuse her of anything but bad luck, she has stuck her head above the parapet.

Let's put it in perspective: she is the CEO of UK-based multi-manager Bramdean Asset Management, which has lost about £250 million, or 10% of its asset base, because it invested in Madoff's hedge fund products. Bramdean has cost Hampshire County Council up to £5 million by advising it to do so too.

Now for a City Superwoman, the same person who warned SG Asset Management that launching a fund in January 2003 was a dire investment decision and the FTSE was set to fall 25%, she made the same mistake as HSBC, BNP Paribas, RBS, Santander and all the other investors.

Who's due diligence failed then?

I have heard of no investor who has reported how their due diligence, their risk analysis or a good honest look at how a business runs, was misled by Madoff's operations.

In the first place there should be an analysis of the investment strategy. The methodology and form of investment is critical within any pension or fund: knowing correct risk levels, whether geographic, type of security, form of access to that security (securities lending, futures, options etc) is critical to an investment policy. If you didn't do that, it is not unfeasible that all your investment managers could be holding sizeable amounts of the same security: how about Northern Rock equities?

Does the risk of holding this form of security fit in with the profile of risk across the portfolio or does it skew it? Are liabilities covered? Indeed does the type of investment fall within the parameters of the legal licensing of your own fund product?

Secondly, you have to assess the risk profile of the company itself and those along the critical supply chain, the service providers, those executing critical parts of the process. While Madoff may have been the former chairman of the Nasdaq Stock Market, it is not enough as an assurance, after all Jeffrey Archer is a peer of the realm.

What is worse is that only a little digging has shown critical flaws in his corporate structure that even the mildest form of due diligence would have revealed. The head of compliance was his brother. This is not in itself illegal but should raise a question.

As an investment company I should also be concerned that the hedge fund's administration and custodial services will make sure I get paid my dividends, is aware of the size of my holdings, move on corporate actions, make sure the shares Madoff's company has bought arrive in the account and counterparties settle.

It is unheard of for a company of the size of Madoff's to do its own custody. The largest players in the custodial market: JP Morgan, Bank of New York Mellon, State Street, Northern Trust, Citi are dominated by trust banks rather than retail (Citi) and investment (JP Morgan) banks and even within their own hallowed halls many custodial contracts go to their competitors.

It goes further. A prime broker has transparency into the books of hedge funds, contributing valuations that enable administrators to calculate net asset value (NAV). They also have to assess counterparty risk: in other words should the fund default on loans or purchases or paying margins on over-the-counter securities, prime brokers have to step up and pay up.

Madoff had no independent prime broker. It was his own fim.

And all of this was audited by a three-man sun-lounging team who went for their McDonalds in golf carts somewhere around Disney World. Mickey Mouse - you bet!

Just one of these issues should have raised eyebrows of even the most junior paralegal in the due diligence team or the secretary to the head of risk analysis. The fact that so many were caught for so long, proffers the question (as did the subprime debacle), do any firms carry out intelligent risk analysis, does governance truly reach the boardroom?

So Nicola and the rest of the ‘boys' in the City and across the world can whine (rightly) about the SEC, but it was they who also failed in the fundamental processes of investment management, corporate governance, let alone of how to run a run a business the best way, and responsibly, on behalf of their investors.

*The scheme is named after Charles Ponzi, who became notorious for using the technique after emigrating from Italy to the USA. he paid high returns but paid them from new contributions to his scheme rather than investment returns.